Inspiration
Emergencies in campuses and workplaces are often handled through fragmented communication—phone calls, emails, manual reports, or isolated monitoring systems. These delays can lead to slow response times and confusion about responsibility. We were inspired to design an intelligent system that could understand situations in real time and coordinate action automatically, much like a digital command center that never sleeps.
What it does
Zeek is a context-aware, multi-step AI agent that detects, analyzes, and responds to incidents by combining real-time data with historical knowledge. It:
- Collects reports, logs, and sensor data into a unified search layer
- Retrieves relevant past incidents to understand context
- Classifies emergencies and assigns priority using analytical queries
- Triggers automated workflows such as alerts, ticket creation, and escalation
- Tracks resolution status and continuously updates decisions
Instead of just answering queries, Zeek takes reliable action to ensure the right response happens at the right time.
How we built it
We built Zeek using Agent Builder with Elastic as the core retrieval and analytics engine.
Architecture Highlights:
- Elasticsearch indexing for structured + unstructured incident data
- Hybrid and vector search to retrieve similar historical cases
- ES|QL queries to calculate severity and detect patterns
- Elastic Workflows to automate alerts, escalations, and reporting
- Reasoning layer (LLM) to decide which tool to use at each step
- Kibana dashboards to visualize incidents, timelines, and response metrics
This created a stateful agent capable of planning → executing → verifying actions.
Challenges we ran into
- Designing true multi-step behavior instead of a simple RAG chatbot
- Structuring data so the agent could reason across time, location, and severity
- Balancing automation with explainability—every action needed traceable logic
- Simulating realistic emergency datasets for testing workflows
- Ensuring the agent selected the correct tool dynamically rather than relying on fixed pipelines
Accomplishments that we're proud of
- Built an agent that acts, not just answers
- Successfully integrated search, analytics, and workflows into one decision loop
- Demonstrated measurable workflow reduction—from manual triage to automated coordination
- Created a scalable design that can extend to factories, hospitals, or smart cities
- Delivered a working prototype within hackathon constraints
What we learned
- Retrieval quality directly impacts reasoning accuracy—context matters more than prompts
- Multi-agent style orchestration requires careful state tracking and validation
- Real-world automation is about connecting systems, not just building models
- Observability and explainability are critical for trust in AI-driven decisions
- Elasticsearch can function as both a knowledge base and an operational memory layer for agents
What's next for Zeek
- Add real IoT integrations (wearables, safety sensors, access logs)
- Introduce multi-agent collaboration (planner, verifier, executor roles)
- Enable geo-spatial intelligence to detect risk hotspots across locations
- Integrate with communication platforms like Slack or email for in-context action
- Expand into domains like industrial safety, healthcare triage, and disaster response
Zeek’s vision is to evolve from a prototype into a deployable operational AI system that helps organizations respond faster, smarter, and more safely.
Built With
- and
- and-agent-control-layer-*-**rest-apis**-?-to-simulate-external-systems-like-sensors
- and-escalation-actions-*-**kibana**-?-dashboards-for-monitoring-incidents
- and-historical-records-*-**agent-builder**-?-to-create-the-multi-step-ai-agent-and-connect-tools-with-reasoning-*-**es|ql-(elasticsearch-query-language)**-?-for-severity-scoring
- and-real-time-analysis-*-**elastic-workflows**-?-to-automate-alerts
- and-system-insights-*-**python**-?-orchestration-logic
- executes
- integrations
- logs
- or-notification-services-*-**vector-+-hybrid-search**-?-to-retrieve-contextually-similar-past-incidents-for-decision-making-this-stack-allowed-us-to-build-a-**stateful
- pattern-detection
- real-world
- reasons-over-it
- reporting-tools
- ticket-creation
- timelines
- tool-using-ai-agent**-that-retrieves-context
